# US 2019/0319973 A1 · Multi-host Threat Tracking > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319973 A1 - Document ID: US20190319973A1 - Status: Published application - Kind: A1 - Application number: 16/454,680 - Filed: 2019-06-27 - Published: 2019-10-17 - Earliest claimed: 2016-03-15 - Assignees: Carbon Black, Inc. - Applicants: Carbon Black, Inc. - Inventors: Jeffrey Albin Kraemer; Ranganathan Gopalan - Web page: https://patentgrep.com/patent/US20190319973A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 17/40: Data acquisition and logging (for input to computer G06F3/00) - G06F 21/562: {Static detection} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2201/86: Event-based monitoring - G06Q 10/0635: Risk analysis of enterprise or organisation activities - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A system and method for tracking data security threats within an organization is proposed. A threat aggregator process executing on an analysis computer system within the organization receives events indicating possible threats observed by and sent from different user devices and aggregates related events into threats. This enables the threats to be analyzed and acted upon at a level of the organization (e.g., across user devices) rather than at the level of the individual user devices. An endpoint telemetry system analyzes threats sent from the aggregator and provides security policies for responding to the threats. In examples, the system can identify attacks of related threats and act upon the related threats of the attack collectively, and can characterize false positive threats sent from multiple user devices as a single extraneous threat. This has advantages over the per-user device focus for responding to threats provided by current systems and methods. ## Claims ### Claim 1 A method for responding to data security threats (“threats”) in an organization, the method comprising: receiving events observed by and sent from within the organization; generating new threats and updating existing threats based on the events; identifying attacks upon the organization based on the threats; and providing security policies that specify actions for responding to threats associated with the identified attacks. ### Claim 2 (depends on 1) The method of claim 1, wherein the threats include one or more related events associated with known data security issues. ### Claim 3 (depends on 2) The method of claim 2, further comprising determining that the events of the threats are associated with known data security issues by comparing event information of the events to Tools/Tactics/Procedures (TTPs) of known data security issues, and appending TTPs of the known data security issues to the matching events. ### Claim 4 (depends on 1) The method of claim 1, further comprising the events including descriptions characterizing the events, and wherein the descriptions include: summary text that describes the event; a name and/or an identifier of a user device that sent the event; and a name and/or an identifier of at least one application executing on the user device, the at least one application identified as being a source of the event. ### Claim 5 (depends on 1) The method of claim 1, wherein the threats include one or more related events and a threat description that includes contents of descriptions of the one or more related events. ### Claim 6 (depends on 1) The method of claim 1, wherein the generating new threats and updating existing threats based on the events comprises: receiving an event from a user device; generating a new threat in response to determining that a description of the received event does not match descriptions of existing threats, adding the event to the new threat and copying the description of the event to the description of the new threat; and updating an existing threat to include the received event in response to determining that a description of the event matches a description of the existing threat. ### Claim 7 (depends on 1) The method of claim 1, wherein the generating new threats and updating existing threats based on the events comprises: receiving an event from a user device; generating a new threat in response to determining that one or more fields of a description of the received event do not match corresponding fields of descriptions of existing threats, adding the event to the new threat and copying the description of the event to the description of the new threat; and updating an existing threat to include the received event in response to determining that one or more fields of the description of the event match one or more corresponding fields of a description of the existing threat. ### Claim 8 (depends on 1) The method of claim 1, wherein the creating and/or updating threats based on the events comprises identifying one or more user devices affected by the threats based on the events, and indicating the identified user devices affected by the threats in descriptions of the threats. ### Claim 9 (depends on 1) The method of claim 1, wherein the identifying attacks upon the organization based on the threats comprises matching fields within descriptions of the threats to determine whether the threats are related, and associating the related threats with possible attacks. ### Claim 10 (depends on 1) The method of claim 1, wherein the identifying attacks upon the organization based on the threats and providing security policies that specify actions for responding to the threats associated with the identified attacks comprises: identifying the attacks by matching possible attacks including one or more related threats to records of known malicious attacks; and executing remediation actions with respect to user devices affected by the threats associated with the identified attacks. ### Claim 11 A system for responding to data security threats in an organization, the system comprising: an analysis computer system for executing a threat aggregator service (“threat aggregator”) for receiving events observed by and sent from within the organization, and generating new threats and updating existing threats based on the events; and an endpoint telemetry system for identifying attacks upon the organization based on the threats, and providing security policies that specify actions for responding to threats associated with the identified attacks. ### Claim 12 (depends on 11) The system of claim 11, wherein the threats include one or more related events associated with known data security issues. ### Claim 13 (depends on 12) The system of claim 12, wherein the threat aggregator determines that the events of the threats are associated with known data security issues by comparing event information of the events to Tools/Tactics/Procedures (TTPs) of known data security issues, and appending TTPs of the known data security issues to the matching events. ### Claim 14 (depends on 11) The system of claim 11, wherein the events include descriptions characterizing the events, and wherein the descriptions include: summary text that describes the event; a name and/or an identifier of a user device that sent the event; and a name and/or an identifier of at least one application executing on the user device, the at least one application identified as being a source of the event. ### Claim 15 (depends on 11) The system of claim 11, wherein the threats include one or more related events and a threat description that includes contents of descriptions of the one or more related events. ### Claim 16 (depends on 11) The system of claim 11, wherein the threat aggregator generates new threats and updates existing threats based on the events by: receiving an event from a user device; generating a new threat in response to determining that a description of the received event does not match descriptions of existing threats, adding the event to the new threat and copying the description of the event to the description of the new threat; and updating an existing threat to include the received event in response to determining that a description of the event matches a description of the existing threat. ### Claim 17 (depends on 11) The system of claim 11, wherein the threat aggregator generates new threats and updates existing threats based on the events by: receiving an event from a user device; generating a new threat in response to determining that one or more fields of a description of the received event do not match corresponding fields of descriptions of existing threats, adding the event to the new threat and copying the description of the event to the description of the new threat; and updating an existing threat to include the received event in response to determining that one or more fields of the description of the event match one or more corresponding fields of a description of the existing threat. ### Claim 18 (depends on 11) The system of claim 11, wherein the threat aggregator generates new threats and updates existing threats based on the events by identifying one or more user devices affected by the threats based on the events, and indicating the identified user devices affected by the threats in descriptions of the threats. ### Claim 19 (depends on 11) The method of claim 11, wherein the endpoint telemetry system identifies the attacks upon the organization based on the threats by matching fields within descriptions of the threats to determine whether the threats are related, and associating the related threats with possible attacks. ### Claim 20 (depends on 11) The system of claim 11, wherein the endpoint telemetry system identifies the attacks by matching possible attacks including one or more related threats to records of known malicious attacks and sends the identified attacks and remediation actions to the threat aggregator, and the threat aggregator executes the remediation actions with respect to user devices affected by the threats associated with the identified attacks. ### Claim 21 (depends on 11) The system of claim 11, wherein the endpoint telemetry system is located in a network that is remote to the organization. ### Claim 22 (depends on 11) The system of claim 11, further comprising a Security Information and Event Manager (SIEM) within the organization that receives threats sent from the threat aggregator, stores the threats in log files, and provides the log files including the threats to the endpoint telemetry system. ### Claim 23 A method for responding to data security threats (“threats”) in an organization, the method comprising: receiving events observed from within the organization; generating new threats and updating existing threats based on the events; identifying attacks upon the organization based on the threats; and providing to incident responders attack information indicating a scope of the identified attacks on the organization and/or which user devices of the organization are affected by the identified attacks. ### Claim 24 A system for responding to data security threats in an organization, the system comprising: an analysis computer system for executing a threat aggregator service (“threat aggregator”) for receiving events observed within the organization, and generating new threats and updating existing threats based on the events; and an endpoint telemetry system for identifying attacks upon the organization based on the threats, and providing to incident responders attack information indicating a scope of the identified attacks on the organization and/or which user devices of the organization are affected by the identified attacks.